Threats affecting pkg:github/cloeille/picsou-finance

Picsou-finance version prior to 1.0.8 contains a timing discrepancy vulnerability in its login endpoint that allows an attacker to determine valid usernames by measuring response times. The login implementation throws an exception immediately for unknown usernames but performs a bcrypt password comparison for existing usernames, causing observable timing differences. This vulnerability does not expose or modify account data directly but can facilitate username enumeration, aiding credential stuffing or brute-force attacks. The issue is fixed in version 1.0.8.